Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.
Published December 2, 2020.
Textpattern Textpattern